Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 12:26

General

  • Target

    fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe

  • Size

    508KB

  • MD5

    6b3f6df19ee5f369d8b474fd8be43dff

  • SHA1

    c8a2019e5023872a3ba84f344dbeeeeb46aee6a3

  • SHA256

    fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f

  • SHA512

    fee80bd4b801b75cc579abea1e837a90822336b79b09c7d1e1549ba0176280936b92767e86ac01a9396bd0de1a9fb04f6b4b931c9c5ac134ed203efc1c2f92d7

  • SSDEEP

    6144:o3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:o3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 11 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 54 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe
    "C:\Users\Admin\AppData\Local\Temp\fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Users\Admin\eosRo6jbz1.exe
      C:\Users\Admin\eosRo6jbz1.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Users\Admin\deuxuj.exe
        "C:\Users\Admin\deuxuj.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1148
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del eosRo6jbz1.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:664
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:268
    • C:\Users\Admin\2veg.exe
      C:\Users\Admin\2veg.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2028
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1492
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1568
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1892
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        PID:1800
    • C:\Users\Admin\3veg.exe
      C:\Users\Admin\3veg.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Users\Admin\AppData\Local\5116369f\X
        *0*bc*d3ef4e7*31.193.3.240:53
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:572
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
          PID:664
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe
        2⤵
        • Deletes itself
        PID:1968
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1984
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Modifies WinLogon for persistence
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1204
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:332
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      1⤵
        PID:1260

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\2veg.exe

        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      • C:\Users\Admin\2veg.exe

        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      • C:\Users\Admin\2veg.exe

        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      • C:\Users\Admin\2veg.exe

        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      • C:\Users\Admin\2veg.exe

        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      • C:\Users\Admin\2veg.exe

        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      • C:\Users\Admin\2veg.exe

        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      • C:\Users\Admin\3veg.exe

        Filesize

        287KB

        MD5

        357d9b4488d3191b0d6197015b326484

        SHA1

        057455015523d5b0b475dce4a49d510ba6a23ee4

        SHA256

        7444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36

        SHA512

        f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc

      • C:\Users\Admin\3veg.exe

        Filesize

        287KB

        MD5

        357d9b4488d3191b0d6197015b326484

        SHA1

        057455015523d5b0b475dce4a49d510ba6a23ee4

        SHA256

        7444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36

        SHA512

        f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc

      • C:\Users\Admin\AppData\Local\5116369f\X

        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

      • C:\Users\Admin\deuxuj.exe

        Filesize

        180KB

        MD5

        62296fa335d9974218b7cd72aacbf4d4

        SHA1

        f5add8a71cb879be353f98c1c0323fbc6bc84328

        SHA256

        8311c751f99108a14fb22b18bcc0d25704d76cbf42b0a462e926b7d04b56dc5b

        SHA512

        8e939262c2789140e689655f9808bb67bae26011cb62e2aa0c11ba86852d5a7a252234f5c480b12a868ed57fdf8fd1274fcb2656928f00a339648e509d643795

      • C:\Users\Admin\deuxuj.exe

        Filesize

        180KB

        MD5

        62296fa335d9974218b7cd72aacbf4d4

        SHA1

        f5add8a71cb879be353f98c1c0323fbc6bc84328

        SHA256

        8311c751f99108a14fb22b18bcc0d25704d76cbf42b0a462e926b7d04b56dc5b

        SHA512

        8e939262c2789140e689655f9808bb67bae26011cb62e2aa0c11ba86852d5a7a252234f5c480b12a868ed57fdf8fd1274fcb2656928f00a339648e509d643795

      • C:\Users\Admin\eosRo6jbz1.exe

        Filesize

        180KB

        MD5

        582c4af3c13d489f7593c6655a9ed25f

        SHA1

        f920f89e59010c5d24507a3556cfa2b8ed406ddc

        SHA256

        560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5

        SHA512

        f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d

      • C:\Users\Admin\eosRo6jbz1.exe

        Filesize

        180KB

        MD5

        582c4af3c13d489f7593c6655a9ed25f

        SHA1

        f920f89e59010c5d24507a3556cfa2b8ed406ddc

        SHA256

        560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5

        SHA512

        f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d

      • C:\Windows\system32\consrv.dll

        Filesize

        29KB

        MD5

        1149c1bd71248a9d170e4568fb08df30

        SHA1

        6f77f183d65709901f476c5d6eebaed060a495f9

        SHA256

        c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

        SHA512

        9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

      • \Users\Admin\2veg.exe

        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      • \Users\Admin\2veg.exe

        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      • \Users\Admin\3veg.exe

        Filesize

        287KB

        MD5

        357d9b4488d3191b0d6197015b326484

        SHA1

        057455015523d5b0b475dce4a49d510ba6a23ee4

        SHA256

        7444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36

        SHA512

        f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc

      • \Users\Admin\3veg.exe

        Filesize

        287KB

        MD5

        357d9b4488d3191b0d6197015b326484

        SHA1

        057455015523d5b0b475dce4a49d510ba6a23ee4

        SHA256

        7444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36

        SHA512

        f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc

      • \Users\Admin\AppData\Local\5116369f\X

        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

      • \Users\Admin\AppData\Local\5116369f\X

        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

      • \Users\Admin\deuxuj.exe

        Filesize

        180KB

        MD5

        62296fa335d9974218b7cd72aacbf4d4

        SHA1

        f5add8a71cb879be353f98c1c0323fbc6bc84328

        SHA256

        8311c751f99108a14fb22b18bcc0d25704d76cbf42b0a462e926b7d04b56dc5b

        SHA512

        8e939262c2789140e689655f9808bb67bae26011cb62e2aa0c11ba86852d5a7a252234f5c480b12a868ed57fdf8fd1274fcb2656928f00a339648e509d643795

      • \Users\Admin\deuxuj.exe

        Filesize

        180KB

        MD5

        62296fa335d9974218b7cd72aacbf4d4

        SHA1

        f5add8a71cb879be353f98c1c0323fbc6bc84328

        SHA256

        8311c751f99108a14fb22b18bcc0d25704d76cbf42b0a462e926b7d04b56dc5b

        SHA512

        8e939262c2789140e689655f9808bb67bae26011cb62e2aa0c11ba86852d5a7a252234f5c480b12a868ed57fdf8fd1274fcb2656928f00a339648e509d643795

      • \Users\Admin\eosRo6jbz1.exe

        Filesize

        180KB

        MD5

        582c4af3c13d489f7593c6655a9ed25f

        SHA1

        f920f89e59010c5d24507a3556cfa2b8ed406ddc

        SHA256

        560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5

        SHA512

        f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d

      • \Users\Admin\eosRo6jbz1.exe

        Filesize

        180KB

        MD5

        582c4af3c13d489f7593c6655a9ed25f

        SHA1

        f920f89e59010c5d24507a3556cfa2b8ed406ddc

        SHA256

        560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5

        SHA512

        f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d

      • \Windows\System32\consrv.dll

        Filesize

        29KB

        MD5

        1149c1bd71248a9d170e4568fb08df30

        SHA1

        6f77f183d65709901f476c5d6eebaed060a495f9

        SHA256

        c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

        SHA512

        9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

      • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

        Filesize

        2KB

        MD5

        40af3963a79222555eb57f76af1a8201

        SHA1

        e6a76cf1b85a7142d3adc3f06fc640afef737118

        SHA256

        e498cf69c90534654d96aa90205429ff9668b0273c9c1c4490626086a1dc163f

        SHA512

        7a91bfb7ce9b1da411dc3abb2d289a0c77cdcaed9df0818f94e206a1660c2e114ca66e2ab9282f1060bcd4764d9cc0608905b17b98e44a15dc91d4bb3de616ac

      • memory/332-168-0x0000000000A30000-0x0000000000A3B000-memory.dmp

        Filesize

        44KB

      • memory/1204-159-0x0000000002AC0000-0x0000000002ACB000-memory.dmp

        Filesize

        44KB

      • memory/1204-142-0x0000000002A90000-0x0000000002A96000-memory.dmp

        Filesize

        24KB

      • memory/1204-169-0x0000000002A90000-0x0000000002A98000-memory.dmp

        Filesize

        32KB

      • memory/1204-176-0x0000000002A90000-0x0000000002A98000-memory.dmp

        Filesize

        32KB

      • memory/1204-163-0x0000000002AC0000-0x0000000002ACB000-memory.dmp

        Filesize

        44KB

      • memory/1204-155-0x0000000002AC0000-0x0000000002ACB000-memory.dmp

        Filesize

        44KB

      • memory/1204-170-0x0000000002AD0000-0x0000000002ADB000-memory.dmp

        Filesize

        44KB

      • memory/1204-146-0x0000000002A90000-0x0000000002A96000-memory.dmp

        Filesize

        24KB

      • memory/1204-138-0x0000000002A90000-0x0000000002A96000-memory.dmp

        Filesize

        24KB

      • memory/1492-90-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1492-102-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1492-130-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1492-89-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1492-94-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1492-96-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1492-101-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1568-107-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1568-108-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1568-175-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1568-105-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1568-131-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1568-121-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1568-117-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1568-103-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1760-171-0x0000000002830000-0x00000000032EA000-memory.dmp

        Filesize

        10.7MB

      • memory/1760-56-0x0000000075931000-0x0000000075933000-memory.dmp

        Filesize

        8KB

      • memory/1892-122-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/1892-113-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/1892-116-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/1892-114-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/1892-123-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/1892-132-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/2008-147-0x0000000030670000-0x00000000306C1000-memory.dmp

        Filesize

        324KB

      • memory/2008-148-0x000000000057B000-0x00000000005B2000-memory.dmp

        Filesize

        220KB

      • memory/2008-166-0x0000000030670000-0x00000000306C1000-memory.dmp

        Filesize

        324KB

      • memory/2008-167-0x000000000057B000-0x00000000005B2000-memory.dmp

        Filesize

        220KB

      • memory/2028-129-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/2028-93-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/2028-91-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/2028-85-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/2028-174-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/2028-84-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/2028-83-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/2028-82-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB